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ABSTRACT 



The principal goal of this research program is to develop a design process for damage 
tolerant aircraft structures using a definition of structural "Level of Safety" that incorporates 
past service experience. The design process is based on the concept of an equivalent "Level 
of Safety" for a given structure. The discrete "Level of Safety" for a single inspection event 
is defined as the compliment of the probability that a single flaw size larger than the critical 
flaw size for residual strength of the structure exists, and that the flaw will not be detected. 
The cumulative "Level of Safety" for the entire structure is the product of the discrete "Level 
of Safety" values for each flaw of each damage type present at each location in the structure. 

The design method derived from the above definition consists of the following steps: 
collecting in-service damage data from existing aircraft, establishing the baseline safety level 
for an existing structural component, conducting damage tolerance analyses for residual 
strength of the new structural design, and determining structural configuration for a given 
load and the required safety level (sizing). The design method was demonstrated on a 
composite sandwich panel for various damage types, with results showing the sensitivity of 
the structural sizing parameters to the relative safety of the design. The "Level of Safety" 
approach has broad potential application to damage-tolerant aircraft structural design with 
uncertainty. 
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EXECUTIVE SUMMARY 



There are at least two fundamental shortcomings to traditional aircraft design procedures 
using factors of safety and knockdown factors. First, these procedures may be difficult to 
apply to aircraft that have unconventional configurations, use new material systems, and 
contain novel structural concepts. Second, levels of safety and reliability cannot be easily 
measured for a structural component. As a result, it is not possible to determine the relative 
importance of various design options on the safety of the aircraft. In addition, with no 
measure of safety it is unlikely that there is a consistent level of safety and efficiency 
throughout the aircraft. The principal goal of this research program is to develop a design 
process for damage tolerant aircraft structures using a definition of structural "Level of 
Safety" that incorporates past service experience. 

In this report, an approach to damage -tolerant aircraft structural design based on the concept 
of an equivalent "Level of Safety" is studied. The discrete "Level of Safety" for a single 
inspection event is defined as the compliment of the probability that a single flaw size larger 
than the critical flaw size for residual strength of the structure exists, and that the flaw will 
not be detected. The cumulative "Level of Safety" for the entire structure is the product of 
the discrete "Level of Safety" values for each flaw of each damage type present at each 
location in the structure. 

The design method derived from the above definition consists of the following steps: 
collecting in-service damage data from existing aircraft, establishing the baseline safety level 
for an existing structural component, conducting damage tolerance analyses for residual 
strength of the new structural design, and determining structural configuration for a given 
load and the required safety level (sizing). 

To demonstrate the design methodology on a new structure, a composite sandwich panel was 
analyzed for residual strength as a function of damage size for disbond, delamination and 
notch damage. A two-step analysis model was used to determine post-buckling residual 
strength for each damage type. The residual strength vs. damage size results were used to 
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demonstrate application of the "Level of Safety" design processes using two example 
problems. The influence of the structural sizing parameters on the overall "Level of Safety" 
was also demonstrated in the examples. Bayesian statistical tools are incorporated into the 
design method to quantify the uncertainty in the probability data, and to allow post-design 
damage data to be used to update the "Level of Safety" values for the structure. Some 
methods of obtaining in-service damage data for the current aircraft fleet have been 
suggested. Concerns regarding the calculation of "Level of Safety" values for existing 
aircraft components have also been discussed. 

The definition of structural "Level of Safety", and the design methodology derived from it, is 
an extension of reliability theory and statistical analysis tools to the design and maintenance 
of damage -tolerant aircraft structures. The method presents a unified approach to damage 
tolerance that allows a direct comparison of relative safety between aircraft components 
using different materials, construction techniques, loading or operational conditions. It 
incorporates planning for the service inspection program into the design process. The use of 
Bayesian statistical tools in the "Level of Safety" method provides a mechanism for 
validating the damage assumptions made during the design process, and for reducing the 
level of uncertainty and risk over the life-cycle of the structure. 
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1 INTRODUCTION 



1.1 Background 

Traditional design procedures for aircraft structures are based on a combination of factors of 
safety for the loads and knockdown factors for the strength. Both the factors of safety and 
knockdown factors have been obtained from the past five decades of design for metal 
aircraft. 

There are at least two fundamental shortcomings to these traditional design procedures. 
First, because the procedures were developed for conventional configurations, metallic 
materials, and familiar structural concepts, these traditional procedures may be difficult to 
apply to aircraft that have unconventional configurations, use new material systems, and 
contain novel structural concepts. Consider, for example, the case of composite materials. 
Adaptations of traditional design procedures to account for larger scatter in composite 
properties and the sensitivity of composite structures to environmental effects and to damage 
have led to a very conservative approach for designing composite structures. This approach, 
in essence, assumes that a "worst case scenario" occurs simultaneously for each design 
condition - temperature, moisture, damage, loading, etc. This results in substantial and 
unnecessary weight penalties. 

A second shortcoming of traditional design procedures is that measures of safety and 
reliability are not available. As a result, it is not possible to determine (with any precision) 
the relative importance of various design options on the safety of the aircraft. In addition, 
with no measure of safety it is unlikely that there is a consistent level of safety and efficiency 
throughout the aircraft. That situation can lead to excessive weight with no corresponding 
improvement in overall safety. 

New structural design procedures based on the concept of "design under uncertainty" help to 
overcome many of these problems. In particular, measures of safety and reliability are 
available during the design process and for the final design. This information allows the 
designer to produce a consistent level of safety and efficiency throughout the aircraft - no 
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unnecessary over-designs in some areas. As a result, designers can save weight while 
maintaining safety. In addition, in design under uncertainty it is possible to determine the 
sensitivity of safety to design changes that can be linked to changes in cost. For the same 
cost, aircraft can be made safer than with traditional design approaches, or, for the same 
safety and reliability, the aircraft can be made at a lower cost. Design under uncertainty also 
has application to the flight certification process, as it allows the uncertainty inherent in any 
new design to be quantified. Thus, flight certification criteria can be established which 
define the safety margins necessary for compliance based on the level of uncertainty 
associated with the design. 

Based on the above consideration, a research program was established by the University of 
Washington to study the feasibility of developing a design procedure based on concepts of 
uncertainty and of applying this procedure to the design of airframe structures for 
commercial transport. The program is being sponsored by NASA Langley Research Center. 
The new design procedure is based on the fact that design data such as loading, material 
properties, damage, etc. are of statistical character. Design procedures based on uncertainty 
have the potential for reducing the weight and cost of airframe structures while maintaining 
prescribed level of safety. These procedures could also help reduce the design cycle time, 
particularly for unconventional aircraft that use new materials and novel structural concepts. 

1 .2 Review of existing technologies 

The non-deterministic design approach is one of the current research emphases in various 
disciplines of engineering (Ref.l, 2, 3, 4). This design methodology has been applied to 
civil, mechanical and electronics engineering applications for decades. In recent years, there 
have been applications to aerospace composite structures as well. Chamis developed a 
probabilistic design procedure for composite structures (Ref. 5). The research has generated 
the Integrated Probabilistic Analysis of Composite Structures (IPACS). The procedure 
combines physics, mechanics, specific structure, system concepts and manufacturing. In 
IPACS, fiber mechanical and physical properties, resin properties, and the fiber placement 
techniques are the input data and all of these data are considered random variables. A 
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probabilistic lamination theory is then established using a micromechanics approach. This is 
followed by a probabilistic finite element analysis based on structural mechanics. The output 
of IPACS includes structural sizing, failure prediction and load limiting application. IPACS 
does not include operational lifetime considerations such as material degradation and random 
damage processes during service. 

Kan, et al., proposed a probabilistic methodology for composite airframe certification. The 
original work focused on probabilistic models to characterize data scatter in composite static 
strength and fatigue-life tests (Ref. 6). The goal was to evaluate structural testing 
requirements to achieve B-basis allowables for flight certification. Their methods were 
extended to include data scatter in bonded and cocured structures, and to assess impact 
damage requirements for certification (Ref. 7). The impact threat to aircraft was 
characterized using a Weibull distribution of impact energy. A damage detection threshold 
of Barely Visible Impact Damage (BVID) was set for a dent depth > 0.05 in. in thin 
laminates. A method was presented for predicting post-impact residual strength of built-up 
structures which incorporates a statistical analysis of data scatter from compression test 
specimens with the impact threat distribution, to give an integrated probabilistic reliability 
analysis procedure. This model was then modified to reduce the number of empirical 
coefficients and test data points needed for an analysis (Ref. 8). 

Rouchon (Ref. 9) has also contributed to composite structural design, primarily in two major 
areas: 1) certification and compliance philosophy; 2) probabilistic inspection for fleet 
reliability. Rouchon' s efforts in the area of certification and compliance philosophy address 
second source material qualification, conditions to simulate environmental effects, and 
damage tolerance demonstration for accidental impact damage. His work on probabilistic 
inspection is focused on the need to detect impact damage in composite structures before the 
critical load level for catastrophic failure is reached (Ref. 10). A simplified probabilistic 
approach was presented for damage tolerance evaluation, where post-impact residual strength 
data are combined with probabilistic assessments of impact damage threats and flight load 
factors to set inspection intervals for maintaining failure probabilities below a threshold 



13 



value. This approach is being used to certify the ATR72 and future generations of Airbus 
aircraft. 

Gary and Riskalla investigated the application of Northrop Grumman 's Probabilistic Design 
Model to determine structural reliability values for a modern composite aircraft (Ref. 11). 
The Northrop Grumman design model is a Monte Carlo simulation in which the probability 
distributions of operating stress and material strength are subjected to lifetime risk drivers 
such as material quality, manufacturing quality, thermal stress, gust, operating environment, 
and operational structural damage. Failure probability is defined as the probability of stress 
exceeding strength. To validate the design model, site visits were conducted at airline 
maintenance facilities and Naval aviation depots to gather historical data on operational 
damage incurred on composite structures. This data was input into the design model to 
assess the structural reliability of the Lear Fan 2100 wing box. 

The works reviewed here are only a small sample of the range of research devoted to 
probabilistic methods applied to aerospace structures, yet they provide important insight into 
how far these methods have come, and illustrate areas where further efforts are needed. 
Chamis's model is an important design tool for assessing the variability in composite 
manufacture, analysis and testing, but it does not incorporate means for evaluating effects of 
service damage on reliability. Kan's probabilistic work is geared towards flight certification, 
and does not directly address design. The methods obtained only apply to a specific damage 
mechanism in composites (impact), and do not incorporate probabilities associated with 
detecting impact damage in an aircraft fleet. Rouchon's work also is geared towards flight 
certification, and acknowledges the role inspection plays in maintaining the safety of 
damage-tolerant structures. He also addresses some of the limitations inherent in 
probabilistic methodologies, namely that a large and detailed database is needed to 
characterize impact damage probabilities, and that the threshold approach to damage 
detection may be inadequate. At the present time, however, he has not proposed any means 
of incorporating these concerns into his probabilistic methodologies. Northrop Grumman's 
design model may be one of the most robust yet to apply probabilistic methodologies in the 
design process, and has been demonstrated on a modern, flight-certified composite airframe. 
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However, it does not incorporate the influence of damage detection probabilities in its 
reliability assessments. 

All of the work reviewed thus far focuses on composite impact as the primary damage 
mechanism driving the use of probabilistic methods in damage tolerance. However, these 
methods can be applied equally as well to other damage mechanisms, and for other material 
systems. Most of this work has been focused on specific areas and applications, and does not 
take a broad overview of the structural design process for reliability. Therefore, there exists 
a need for a unified probabilistic approach to reliability that is independent of specific 
material systems and structural configurations, and that can be applied to the entire life-cycle 
of a structure. It should take into account the influence of detection probabilities in setting 
inspection intervals and defining critical damage thresholds, and also account for the 
existence of multiple damages of different types in a structure. This is the thrust of the 
current research effort outlined in this report. 
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2 OBJECTIVES 



The specific goals of this research program are to establish a workable definition of 
acceptable structural "Level of Safety" based on probabilistic assessments of in-service 
accumulated damage to aircraft components, and the ability of non-destructive inspection 
methods to detect such damage. The resulting definition will be used to develop a design 
process which evaluates the equivalent "Level of Safety" of an existing aircraft structure, and 
uses this value in the design of a new structure which matches or exceeds the existing "Level 
of Safety" value. The new design method is to be an objective, quantifiable, data-driven 
process that will allow comparisons of relative safety to be made between dissimilar aircraft 
components and structures using different material systems, load requirements, structural 
design details, etc. Using the identified design methodology, explicit safety-based resize 
procedures will be developed incorporating deterministic analyses of residual strength 
properties for specific structures. The resize procedures will be used to demonstrate 
structural sizing sensitivities to safety-based design requirements and flight certification 
criteria. The result will be a uniform design methodology that allows utilization of service 
data and operational experience to quantify the "Level of Safety" of the existing aircraft fleet, 
and that can also be used to quantify the uncertainty associated with the use of new materials 
and structural concepts in future aircraft designs. 
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3 EQUIVALENT LEVEL OF SAFETY APPROACH 



3.1 General Approach 

A general approach for determining the equivalent "Level of Safety" of an aircraft structure 
is defined in this chapter. A mathematical definition of structural "Level of Safety" based on 
a probabilistic damage tolerance approach is derived in Section 3.2. This method is used to 
evaluate the "Level of Safety" of existing aircraft structures using damage data collected 
from in-service experience, combined with detection probabilities for each damage type. The 
resulting values establish a safety baseline for which future design efforts must meet. A 
design process is defined for new materials and structural concepts which quantifies the 
uncertainty in the damage tolerance behavior of these applications, and applies the "Level of 
Safety" definition to size the structure so that the baseline safety value is maintained or 
improved upon. Once the structure is built and placed in service, inspection and maintenance 
data can be used to validate the assumptions used in the design process, and to reduce the 
level of uncertainty associated with the structure. 

A flow-chart of the approach to developing equivalent-safety aircraft structures is given in 
Figure 1 . The detailed explanation of the approach is given in the following context. 

3.2 Defining "Level of Safety" 

To enable the objective evaluation of the level of safety of an aircraft component, a 
quantitative method is needed which incorporates design data along with data on the amount 
and type of damage a part is exposed to during its operational life. Modern damage- 
tolerance philosophies require that damage accumulated during the service life of a 
component be detected and repaired before the strength of the component is degraded beyond 
some design threshold. A convenient way to define the "Level of Safety" based on these 
criteria is the joint probability density function approach for damage size and NDI detection 
limit. 
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This "Level of Safety" concept was initially proposed by Bjorn Backman of the Boeing 
Commercial Aircraft Group, and is defined in statistical terms as: "The compliment of the 
probability that a flaw size that is larger than the critical flaw size for residual strength of 
the structure is incurred, and that the flaw will not be detected." 

There are two random variables involved: 1. Damage size "a", which is continuous; and 2. 
Detection state "d", which is discrete. Since they are not independent, the joint probability 
density function Pj(d,a) is: 

Pj(d,a) = p c (d\a)p(a) (3.2-1) 

in which p c (d\a) is the conditional probability density function and p(a) is the marginal 
probability density function of actual damage size. 

Because random variable "d" has only two possible values, that is: 

di — damage is detected 
d2 — damage is not detected 

the marginal probability density function p(a) is the sum of two terms. 

p(a) = pj(di,a) + Pj(d 2 ,a) 

= pdd^pia) + p c (d 2 \a)p(a) 

= [p c (di\a) + p c (d 2 \a)]p(a) (3.2-2) 
Thus, 

IpddM) + p c (d 2 \a)] = 1 (3.2-3) 

When the conditional probability density function p c (d\a) is evaluated at d = di, it stands for 
the probability of detection under the condition that the damage size is a. Let Pd(o) denote 
the probability of detection for damage size a, that is: 

p c (d 1 \a)=P D (a) (3.2-4) 
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Using equation (3.2-3), we have 

p c (d 2 \a) = l -P D (a) (3.2-5) 
Substituting (3.2-4) and (3.2-5) into (3.2-2) yields: 

p(a) = p(a)P D (a) + p(a)[l - P D (a)] (3.2-6) 

The first term of (3.2-6) is proportional to the probability density function of detected 
damage size po(a), or mathematically (Multiplication Rule): 

p(a)p c (di\a) =f(di)g(a\di) (3.2-7) 

in which, p c (d]\a) = Pd(o), g(a\di) = po{a) mdf(di) is a constant. Therefore, 

p(a)P D (a) = Cpo(a) or p(a) = Cp (a)/P D (a) (3.2-8) 

where C is a normalizing constant that is determined by the condition of: 

]p(a)da = l (3.2-9) 



Substituting (3.2-8) into (3.2-9) yields: 

]c^4a=\ or C = l/]^-da (3.2-10) 
Therefore, according to (3.2-8): 

p(a) = ^/]^da (3.2-11) 

Note that the actual and detected damage size distributions are two distinct functions in this 
equation. 

Finally, "Level of Safety" is defined as 1- Probability(damage size > a c I not detected ), 
where a c is the critical damage size for failure of the structure: 
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Level of Safety"=l- J p(a)[l- P D (a)]di 



la 



(3.2-12) 



Using equation (3.2-11) for p(a): 



Level of Safety" =1 - \ J ^^\l-P n (a)Ua 





Po(a) 
P D (a) 



da 



(3.2-13) 



The above definition assumes a single inspection event at a fixed point in time, and that only 
a single discrete- source flaw is present in the structure. In most real structures, this is 
generally not true. Sometimes there is no flaw, and other times there are multiple flaws. The 
number of flaws is another random variable that must be involved to define the Level of 
Safety. 

Assuming that hazard due to an individual flaw is independent of the existence of other flaws 
and there is no interaction between each of the multiple flaws, then the proper definition of 
"Level of Safety" for multiple flaws should be: 



in which the total number of flaws present in the structure at the time of evaluation is a 
random variable, for which the mean is ju . According to this definition, the "Level of 
Safety" is reduced as the number of flaws increases. Whether or not there is interaction 
between multiple flaws is highly dependent on the size and location of the damages relative 
to each other, and relative to the stress concentration zones in the structure. Damage zone 
interaction poses a significant analytical and modeling challenge to the structural designer, 
and will not be addressed any further here in order to simplify the method as much as 
possible. 

In the case that various damage mechanisms exist simultaneously in the structure, each flaw 
type has its own probability distributions. Thus, the above definition should be modified to: 



Level of 




(3.2-14) 
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where / denotes damage type, /ij is the mean number of flaws of type / and Nt is the total 
number of damage types possible in the structure. The lower integration limit a C i is 
determined by damage tolerance criteria. When Nt, Poi(a), Pdi(o), jUj, (i=1,2,...JSIt) are 
known, "Level of Safety" can be expressed as a function of a C i, (z=l,2,. . .,Nt), that is: 

f \ 
') 



'Level of Safety"=F a c ^a c < ^a r (3.2-16) 



For a given structure and load, a c \ can be found by deterministic structural analyses as the 
critical flaw size that can be tolerated by the damaged structure. Hence, a C i is a function of 
load and structural geometry with specific materials, that is: 

ac =F,(P,l), i = l,2,-N T (3.2-17) 



where P is load and / is a structural sizing dimension such as sheet metal gage thickness, or 
the thickness of a face-sheet laminate in a sandwich panel. Substituting Equations (3.2-17) 
into Equation (3.2-16) yields: 

"Level of Safety" = F o (P, I) (3.2-18) 

Equation (3.2-18) relates load, structural size and "Level of Safety". When the load applied 
to a structure and the structure's dimension are given, "Level of Safety" can be evaluated 
using Equation (3.2-18). Alternatively, when required "Level of Safety" and load are given, 
the structure can be sized by solving Equation (3.2-18) for /. 

In the case of multiple location damage in a structure, the definition of "Level of Safety" is 
further modified to: 
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Level of Safety" =Y[Y[\\- 




[l-P DlJ (a)}ia /l 




da 



(3.2-19) 



where j denotes damage type, Nl is the total number of damage locations, and N T j is the total 
number of damage types at location j. 

In turn, the "Probability of Failure" should be: 

" Pr obability of Failure" = 1 - " Level of Safety" 



An illustrative example problem is given in Chapter 5. 
3.3 Establishing a Baseline Level of Safety 

To establish the equivalent "Level of Safety" needed for new designs to maintain the same 
level of safe operation as the current aircraft they are meant to replace, the "Level of Safety" 
of the current aircraft fleet must be benchmarked. This process involves collecting service 
data for the various aircraft types of interest, and using design data from the Original 
Equipment Manufacturer (OEM) to evaluate the probability that a critical flaw in the aircraft 
structure will go undetected under the normal inspection regime. Damage-tolerance design 
philosophy states that a flaw size becomes critical when the residual strength of a structure 
exposed to the flaw is lower than the strength needed to maintain safe operation of the 
vehicle. Under current design and certification practices, this residual strength value is at the 
design Limit Load for the structure. 

Detailed analyses must be performed for each aircraft component to ensure that all damage 
mechanisms and failure modes that the parts are vulnerable to are accounted for. A "Level of 
Safety" value based on the formula derived in Section 3.2 must be calculated for the various 
damage types in each component, and these values will be unique to that component in that 



N L N Tj ~ 

i-nnf-f 

j=1 i=1 a 




(3.2-20) 
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particular application. In addition, reliable and repeatable methods of detecting service 
damage need to be identified and quantified for the existing structures. Much research has 
been done in the area of defining Probability of Detection (POD) curves for various forms of 
Non-Destructive Evaluation (NDE), and most of this work has been concentrated in the area 
of crack detection in stress-skinned metal airframes (Ref. 12, 13, 14). However, not all 
damage mechanisms inherent in a component have POD curves readily available for the 
specific application of interest. Many factors, such as part geometry, part location, the skill 
of the NDE equipment operator, or the environment in which the inspection takes place will 
significantly affect POD results, and can shift the curve dramatically one way or the other. 
All of these variables need to be taken into account in the evaluation of equivalent "Level of 
Safety", as they can have an importance equal to or greater than the deterministic aspects of 
residual strength calculation. Extensive testing and analysis may be necessary to verify that 
the assumed values of the POD curves are actually being achieved during service inspections. 

Another essential element to the "Level of Safety" calculations is the availability of in- 
service detected damage data for the specific structures of interest. The data is necessary to 
define probability density functions of detected damage sizes, and to characterize the amount 
of damage accumulated in a given time. A more detailed discussion of this topic is presented 
in Section 3.4. 

Establishing the baseline "Level of Safety" for an existing aircraft component may be one of 
the most difficult and labor-intensive steps in the design under uncertainty process, but it is 
necessary to establish exactly what the vulnerabilities of existing structures are to service- 
induced damage. The results of this step are then used to define the minimum allowable 
"Level of Safety" for future structural designs that share similar functions and operational 
requirements. 

3.4 Collection of Flaw Data on Existing Structures 

A critical component in the determination of "Level of Safety" is the characterization of 
detected damage size distributions p (o) based on inspection data for an existing structure. 
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Inspection data to be obtained for each part must include the type of damage, size of damage, 
frequency of occurrence over a given time period, damage location and the method of 
detection. A histogram for the flaw size distribution within a given service period can then 
be constructed. Although this appears to be a monumental task, much of this data is already 
collected for the U.S. commercial aircraft fleet on a regular basis. Licensed repair facilities 
regularly submit maintenance actions on commercial aircraft to the FAA in the form of 
Service Difficulty Reports (SDR's), which are collected in a database (SDRS) that is 
accessible to the public. Although the database is not a comprehensive archive of all 
instances of detection and repair of flaws, it can provide much of the data necessary for 
aircraft designers and certification authorities to develop consistent damage size distribution 
curves for structures under real- world operational conditions. Small changes in the format of 
the system may make it easier to utilize the data for "Level of Safety" calculations. 
However, further investigation into the details of this specific application is beyond the scope 
of this research effort. 

To demonstrate the possible utility of such a tool, Boeing has succeeded in collecting raw 
data for discrete- source cracks in the fuselage skins of several of its aircraft using the SDRS 
database. From this data, a Weibull distribution can be fitted through the data points to give 
a first-order estimate of the probability density function of detected crack sizes p (o) in an 
aircraft structure. It should be noted that the sizes of these detected cracks are a function of 
the method of detection, hence the need to define the detection method for each data point 
utilized. 

Other methods have also been used to obtain damage data on in-service aircraft. Gary and 
Riskalla used on-site visits to airline maintenance facilities and Naval aviation depots to 
evaluate the damage characteristics of composite airframe structures for their work on 
probabilistic design methodologies (Ref. 11). Regardless of the data collection methods 
utilized, it should be apparent that it is virtually impossible to record every instance of 
detected damage over the lifetime of a component, so we are forced to deal with an 
incomplete picture of the true distribution of damage in a structure. As the size of the 
available data set is reduced, more and more uncertainty creeps into the estimation of the 
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probability density functions. Research is ongoing to characterize the uncertainty of density 
functions associated with limited data sets, and to explore the sensitivity of "Level of Safety" 
calculations to these effects. 

3.5 Application of Methodology to Advanced Structural Design Concepts 

With a baseline value for the "Level of Safety" of an existing structure in place, new 
materials and structural concepts can be incorporated into the design of replacement 
structures with higher levels of performance, while maintaining or improving upon current 
safety levels. The structural integrity of existing aircraft is ensured primarily through 
deterministic analysis and testing in the design process and extensive in-service experience, 
most of which has been derived from traditional aluminum alloy, stressed-skin construction 
techniques. The lack of service experience with new materials and structural concepts makes 
it difficult for these applications to find their way onto new aircraft designs, owing to the 
large amount of uncertainty regarding how the advanced structure will perform under an 
operational environment. 

Using a traditional building block approach, damage mechanisms and their effect on residual 
strength must be identified for any new material or structural system. This process starts at 
the material level, and gradually works up through the component and sub- structure level to 
the final system design level. Along the way, assumptions are made about the nature of the 
damage environment the structure will be exposed to in service, and how the symptoms of 
damage will manifest themselves to the operator. Reliable means of detecting the various 
damage mechanisms must be identified and put into place before the concept can be declared 
ready for service, and there are also uncertainties associated with this process. 

The "Level of Safety" methodology defined previously allows the engineer to incorporate 
these uncertainties into the design process. By carefully choosing the parameters of the 
statistical functions that define the probability distributions for detected damage size p (o) 
and detection probability Pd(o), the designer can quantify the relative amount of risk in the 
concept. Use of component test data, experience with similar concepts in different 
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applications, empirical evidence and engineering judgement are all tools that can be used to 
define the level of risk inherent in the new design. 

With the uncertainties in the damage tolerance characteristics of the new concept accounted 
for, the "Level of Safety" definition is then used to generate curves of "Level of Safety" 
values vs. flaw size for each type of damage mechanism present in the structure. Using the 
baseline "Level of Safety" value as an allowable, critical damage sizes can be identified, 
either individually or in combination, that will give a safety level equivalent to previous 
designs. Deterministic analysis methods are then used to generate contour plots of residual 
strength vs. flaw size for each damage mechanism, as a function of the structural sizing 
parameters chosen beforehand. With these relationships defined, the structure can now be 
sized for a given load level to yield a relative damage-tolerance safety equal to, or greater 
than the existing structure. 

3.6 Damage Size Updating Schemes 

Once a new structure has been built and put into service, data on how it is actually 
performing under operational conditions becomes available through scheduled inspection and 
maintenance actions. The data can be utilized to validate the initial assumptions about 
damage tolerance behavior made in the design process, and to reduce the level of uncertainty 
inherent in those assumptions. This can be accomplished by the use of Bayesian statistical 
methods (Ref. 15) to modify the distribution curves for detected damage sizes. Based on the 
revised curves, "Level of Safety" values can be recalculated for the structure. If it is found 
that the value has decreased due to the accumulation of larger or more frequent damage than 
initially assumed during design, the inspection and maintenance program can be revised to 
provide earlier or more frequent detection opportunities in a given time period, and the 
"Level of Safety" can be returned to its design value. 

The Weibull relation is a very well known model used to predict systems reliability in 
manufactured products. Failure mechanisms in many different mechanical systems can often 
be found to approximate Weibull distributions, so this model will be chosen to represent the 
probability density function of detected damage size p (o) in the "Level of Safety" method. 
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Other statistical models, such as Normal, Gamma or Log-Normal distributions may be 
appropriate, depending on the behavior of the damage mechanism of interest. For simplicity, 
we will only be concerned with the Weibull distribution here, however the concepts 
discussed are equally applicable to any statistical model of a continuous random variable 
distribution. The probability density function of the Weibull model is: 



/ \ & a— l 

P (<*)=-jpr a exp 



P 



v J 



(3.6-1) 



Assume that the initial detected damage size distribution has Weibull parameters a = 2 and f5 
= 4. In Bayesian analyses, the parameters in the density function are considered random 
variables. However, for simplicity, the scale parameter f5 is assumed to be a constant 4 for 
initial detected damage size distribution: 



a 



p (a\a)=—a a ~ exp 



'a} 
v 4 / 



(3.6-2) 



The shape parameter a is assumed to follow a Gamma distribution with its mean of 2, and a 
standard deviation of 0.4, that is: 



/. (a) = 



1 



0.08 25 r(25) 
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(3.6-3) 



for a > 0, otherwise f ( a) = 0. When new detected damge size data are obtained as ai, a?,. . ., 
a n , the detected damage size distribution can be updated using the new information. The 
actual detected damage sizes, ai, a?,. . ., a n , are random variables. 



Let fj(ai,ci2,. ..,a n ,a) denote joint probability density function of ai,a2,...,a n and a. The 
probability density function of a under condition of given detected damage size data, 
ai,a2,...,a n , is: 
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/,(flrl gl ,g 2 ,-,g,) = „ J 1 2 " (3.6-4) 

jf J (a l ,a 2 ,---,a„,a)da 

Let g(ai,ci2,. . .,a n \ <x) denote conditional joint probability density function of ai,a-2,. . .,a n under 
condition of given a. Then: 

f j (a 1 ,a 2 ,--,a ll ,a) = g(a 1 ,a 2 ,--,a ll \a)f (a) (3.6-5) 
Substituting (3.6-5) into (3.6-4) yields: 

/.(«l« L ,^,-,0' . < "" V "' l '-" )/ '"" (3-6-6) 

J^(a 1 ,a 2 ,---,a w ,la)/ (a)da 

Since random variables ai,a2,.. .,a n are mutually independent, we have: 

n 

g{a l ,a 2 ,---,a n \ a) = Y[p (a i \ a) (3.6-7) 
Substituting (3.6-7) into (3.6-6) yields: 

n 

Y[pM, \<x)f (a) 

f u (a\a 1 ,a 2 , — ,a„)=- r J f (3.6-8) 

jtlPotei \a)f (a)da 

-oo ;'=1 

That is, the probability density function of a under condition of given ai,a2,. . .,a n . The prior 
and the posterior distributions of a are plotted in Figure 2. The Bayesian estimate of a is the 
mean of the updated random variable a, that is: 

a = ^of u (a I a l ,a 2 ,---,a ri )da (3.6-9) 

The updated distribution of detected damage size is obtained using the Bayesian estimate of 
alpha for the Weibull distribution of detected flaw size: 
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(3.6-10) 



The initial and updated flaw size distributions are given in Figure 3. An alternative approach 
to reach an updated detected flaw size distribution is to use the marginal probability density 
function of p (a\a) of Equation (3.6-2), that is: 



p (a) =)p {a\ a)f u (a)da = J — a"" 1 exp 



'a} 
v 4 / 



f u (a)da 



(3.6-11) 



where f„(oc) is the updated probability density function of a, which is given in Equation (3.6- 
8). As an example, when newly detected damage sizes are aj = 3 inch, a 2 = 4 inch, a 3 = 5 
inch, n = 3, the Bayesian estimate of a is calculated as 2.1831 using equations (3.6-2), (3.6- 
3), (3.6-8), (3.6-9). The updated probability density function of the detected damage size is 
equation (3.6-10). 



When both Weibull parameters a and /? are treated as random variables, these parameters can 
be updated simultaneously. Let us assume that initial a and f5 are independent. Then, the 
joint probability density function of a and f5 is: 

f (a,/J) = f (a)f (/J) (3.6-12) 

Similar to the derivation of (3.6-8), the updated joint probability density function of a and /?, 
under the condition of measured flaw sizes ai,a-2,.. .,a n , is obtained from: 

f[p (a, \ a, P)f (a,P) 

f u (a,p\a 1 ,a 2 ,-,a„) = ^ zr f± (3.6-13) 

]]t[Poio,\a,P)f {a,P)dadp 



The marginal probability density functions of a or ]3 are then derived through integration as: 
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f m (a I a x ,a 2 ,- ■ -,a„) = \f„(a,P I a x ,a 2 ,- ■ -,a n )dp 
ffriP la i> a 2 '■■■.«») = \f u (oe,fi\a l ,a 2 ,--;a ll )da 



(3.6-14) 
(3.6-15) 



The Bayesian estimate of a or f5 is the mean of the updated random variable a or /?, 
respectively. 



\of au (a\a l ,a 2 ,---,a n )da 
P=)pf Pll (P\a l ,a 2 ,-,a n )dP 



(3.6-16) 



(3.6-17) 



The updated distribution of detected damage size is obtained using Bayesian estimates of a 
and P for the Weibull distribution: 



p (a\a,fi) = j-a S: - l exp 



( \ 
a 



(3.6-18) 



Alternatively, the updated distribution of detected damage size can also be obtained using the 
marginal density function through integration as follows: 



p (a) = j jp o (a\a,0)f u (a,0\ a^a^--- ,a n )dad/3 

f u (a,p\a l ,a 2 ,---,a„)dadJ3 



\jji^~ lexp 



(3.6-19) 



It should be pointed out that the above Bayesian approach is to update detected damage size 
distribution using later obtained damage size measurements that must have the same 
probability of detection. When different probabilities of detection are employed, the detected 
damage size must be modified before being used in Bayesian updating. Such a modification 
can be performed accordingly as: 
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P D 2 ( a 2) 



(3.6-20) 



where aj and #2 are damage sizes obtained by inspection type 1 and 2, respectively and 
Pdi(o) and Pd2(o) are corresponding probabilities of detection. When functions Pdi(o) and 
Pd2(o) are available and ai is detected, then #2 can be determined by solving Equation (3.6- 
20), and vice versa. 

An alternative way of combining new and old information is to update "actual" damage size 
distribution instead of detected damage size distribution. The "actual" damage size 
distribution p(a) can be estimated from detected damage size distribution and probability of 
detection using Equation (3.6-11). 

If p(a) is selected to be the basic variable, the definitive equation for "Level of Safety" (3.2- 
14) becomes: 



The same Bayesian method as that developed for po(o) can be applied to update "actual" 
damage size distribution, p(a). 

3.7 Discussion 

The definition of structural "Level of Safety", and the design methodology derived from it, is 
an extension of reliability theory and statistical analysis tools to the design and maintenance 



Level of 




(3.6-21) 



and the "Probability of Failure" should be: 




(3.6-22) 
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of damage-tolerant aircraft structures. This methodology is one of the first attempts to 
develop a unified probabilistic approach to damage tolerance that encompasses all of the 
parameters specific to the design of aircraft structures, but that is flexible and general enough 
to be applicable to any type of material or structural configuration. Several characteristics of 
this approach are unique from other reliability-based damage tolerance methods that precede 
it. 

The first is the differentiation in the method between probability distributions of detected 
damage size po(o) and actual damage size p(a). This is a very important distinction often 
overlooked in previous methods. Any attempt to collect data on damage size distributions in 
a structure is subject to the probability of detection of the inspection method used. Thus, 
damage size data should generally be represented by probability density functions for 
detected damage size whose distributions go to zero as the damage size goes to zero. This is 
necessary because an inspection method does not exist that can detect a flaw of zero size. 
The implications of this are that the actual distribution of damage size in a structure can 
never be exactly characterized, because there will always be uncertainty associated with the 
distributions of po(o) and detection probability Pd(o). Many probabilistic analysis methods 
in use today assume that the detected and actual damage size distributions are the same, 
which may lead to erroneous or unconservative reliability results. 

A second aspect unique to this methodology is the use of Bayesian statistical tools to provide 
a means to characterize the uncertainty associated with the probability distributions in the 
"Level of Safety" method, and to enable the use of post-design inspection data to validate the 
probabilistic assumptions. The tools allow the designer to investigate the effects unknown 
risk factors may have on the safety of the structure, without having specific data available a 
priori. These effects can then be incorporated into the design without resorting to arbitrary 
knock-down factors. 

Another unique aspect is the incorporation of inspection intervals to the reliability estimates 
for a structure. Although the addition of this variable to the derivations of the "Level of 
Safety" formulas has not been accomplished to date, it will be included in future iterations of 
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the "Level of Safety" methodology. This ultimately will allow the important parameters of 
an inspection and maintenance program to be included as essential variables in the 
preliminary design process, where maximum benefit can be realized in the sizing of the 
structure to obtain the best performance for the lowest life-cycle cost. 

3.8 Mathematical Considerations in the Level of Safety Formulation 

As mentioned in Section 3.7, the "Level of Safety" methodology differentiates between 
probabilities of detected damage size po(o) and actual damage size p(a). The resulting 
derivations have important statistical and numerical implications on the shapes that these 
distributions can assume. By examining the first form of Equation (3.2-8), it can be seen that 
the detected damage size distribution po(a) is highly dependent on the distributions of actual 
damage size p(a) and detection probability Pd(o). 



The form of the PDF for detection probability should be such that as the damage size 
approaches either zero or some minimum detection threshold, the probability of detection 
will go to zero. One assumption implicit in the statement of Equation (3.2-8) is that we can 
assign a probability to the actual distribution of damage sizes in a structure. This implies that 
p(a) must be finite over any interval of damage size greater than zero, and zero elsewhere. 
Therefore, the product of the actual damage size and detection probability distributions, 
detected damage size distribution po(a), must also go to zero as the damage size approaches 
zero. These characteristics are inconsequential for the formulation of Equation (3.2-8), but 
pose significant problems in the calculation of the normalizing constant C if it is in the form 
of Equation (3.2-10). 



In this form, C is an improper integral with the value 0/0 at the lower integration limit of 
zero. Plotting the integrand as a function of a would show that it approaches infinity as a 



Cpo(a)=p(a)P D (a) 



(3.2-8) 




(3.2-10) 
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goes to zero. Since the integrand is proportional to p(a), the actual damage size distribution 
will also go to infinity as a goes to zero. Improper integrals of this type can be integrated 
depending on the shape of the distribution. Assume that the integrand function is 
proportional to the function for values of a close to zero. In order for the integral to be 
finite on the interval [0, °°], the order of singularity f5 must be less than 1. For the types of 
distributions assumed for po(o) and Pd(o), a closed- form expression for the integrand is not 
generally available, so the order of singularity of the function cannot be determined 
analytically. Numerical integration can be used to check the relative convergence of the 
integral, provided that convergence is rapid enough to be evaluated satisfactorily before the 
roundoff limits of the integration routine are encountered. Equation (3.2-10) can be 
redefined as: 



where the limit is approximated by some small value of e away from zero. Note that relative 
numerical convergence is a necessary, but insufficient condition to guarantee absolute 
convergence of the integral. There may be cases where the integral appears to converge, but 
actually diverges in the limit, particularly if the order of singularity is near one. 

The parameters that define the distributions of po(o) and Pd(o), and in fact the distributions 
themselves, must be carefully chosen so that the integral converges to a finite value. If the 
integral diverges, the initial assumption that we can assign a probability to the actual damage 
size distribution is violated, and the values used for the parameters of the distributions are not 
admissible for the function. The results of these discussions emphasize the need to carefully 
quantify the probability of detection for any damage size data accumulated on a given 
structure. Failure to do so can result in distributions of actual damage size that are not valid 
probability density functions. 
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(3.8-1) 
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4 RESIDUAL STRENGTH DETERMINATION OF EXAMPLE 

STRUCTURE 

4.1 Introduction 

To demonstrate the equivalent "Level of Safety" approach as applied to an advanced 
structural concept, a graphite-epoxy honeycomb sandwich composite was selected to be used 
as an example material system for the redesign of a metal structure. The damage 
mechanisms inherent in composite sandwich structures have been well-characterized through 
many years of research and testing. Also, there are many composite sandwich structures 
(flaps, ailerons, elevators, rudders, etc.) currently in use throughout the civil and military 
aircraft fleets. Service-induced damage data is therefore available for a variety of these 
applications. 

As part of the process of applying the equivalent safety methodology to a new structure, a 
deterministic structural analysis is developed for the characterization of the residual strengths 
of the sandwich panels under different types of damage. The established damage tolerance 
results were then used as inputs into the probabilistic design methodology. 

4.2 Material Systems and Properties 

The selected material system is a honeycomb sandwich panel, in which the face-sheet is a 
graphite-epoxy laminate and the core is made of Nomex. Variations in the strength and 
stiffness of the laminate were created by changing the number of plies and their stacking 
sequence. Three different lamination systems are used in this research. The stiffness of the 
core varies with honeycomb density, and Nomex honeycomb cores of three different 
densities were used in the study. 

The ply properties of graphite/epoxy and the honeycomb core are: 
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Tension: Ei = 22.9 mpsi, E 2 = 1.34 mpsi, vi 2 = 0.34, 

G12 = G13 = G23 = 0.29 mpsi, 
Strength in fiber direction, X = 350 ksi. 
Maximum longitudinal strain, 8l = 15300 (18 
Maximum transverse strain, 8t = 5680 (18 
Maximum engineering shear strain, 7Lt = 21000 (18 

Compression: Ei = 22.0 mpsi, E 2 = 1 .34 mpsi, vi 2 = 0.34, 
G12 = G13 = G23 = 0.29 mpsi, 
Strength in fiber direction, X' = 295 ksi. 
Maximum longitudinal strain, 8l' = 13500 (18 
Maximum transverse strain, &r' = 5680 (18 
Maximum engineering shear strain, 7Lt' = 21000 (18 

Core (1): Ej = E 2 = 200 psi, E 3 = 20 ksi, v 12 = 0.5, v 13 = v 23 = .01, 

Gi 2 = 20 psi, Gb =7 ksi, G 23 = 3.5 ksi. 

Core (2): Ei = E 2 = 600 psi, E 3 = 60 ksi, vi 2 = 0.5, vi3 = v 2 3= .01, 

G12 = 60 psi, Gb =13 ksi, G 23 = 6 ksi. 

Core (3): Ej = E 2 = 900 psi, E 3 = 90 ksi, v J2 = 0.5, vi 3 = v 23 = .01, 

G12 = 90 psi, Gb =17 ksi, G 23 = 9 ksi. 

The thickness of the lamina is 0.005 inch and the thickness of the core is 1.0 inch. 
The three laminate lay-up sequences are: 

Laminate (1): [-45/0/45/0/90] s laminate thickness = 0.05 inch; 

Laminate (2): [-45/0/45/90] 2s laminate thickness = 0.08 inch; 

Laminate (3): [-45/0/45/0/90] 2s laminate thickness = 0. 10 inch. 
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4.3 Tensile Strength of the Laminates 



The tensile strength of the laminates is determined by first-ply failure theory. Using lamina 
property data for Laminate (1), [-45/0/45/0/90] s ,we have: 



0.6198 0.1220 
0.1220 0.4027 
0.1451 



mpsi 



When the longitudinal strain reaches the maximum transverse strain of the lamina, 822 = 5680 
(18, the 90° ply fails. The resultant stress versus strain relation is obtained as: 
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-5680 
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0.1451_ 





The solution of the above equation is: 
N x = -3311 lb/in 

8 y = 1721 (18 
Yxy = (18 

As the load increases further, the stiffness properties of the 90° ply lamina change to Ei 
22.9 mpsi, E 2 = V12 = G12 = 0. Then, the stiffness matrix of the laminate becomes: 



W 2) ]- 



0.6063 0.1174 
0.1174 0.4010 
0.1359 



mpsi 



According to stress resultant versus strain relation: 
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The strain components in terms of load intensity are expressed as: 
e x = 1.5609 N x (2) |ie 

8y = -0.4570 N x (2) |ie 

Y xy = 0|l£ 

Using Mohr's circle, strain components in ±45 degree directions are determined as: 
8 45 = 0.5520 N x (2) |ie 

8 45 = 0.5520 N x (2) |ie 

y 45 = 2.0179 N x (2) |ie 

Using the maximum strain failure criteria, the failure load intensity can be determined as: 

For the 0° ply lamina: 
' 15300 



N. (2) = < 



1.5609 

5680 
1 0.4570 



9802 lb I in longitudinal direction 
12429 lb I in transverse direction 



For the 45° ply lamina: 
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f 15300 



= 27717 lb I in longitudinal direction 



0.5520 




5680 



= 10289 lb I in transverse direction 



0.5520 



21000 



= 10406 lb I in shear failure 



2.0179 



Comparing these results, the 0° ply fails first in its longitudinal direction with increasing 
load. The failure load intensity is 9802 lb/in. After that, the strength of the laminate 
tremendously drops, which means the laminate fails. Therefore, the tensile strength of 
Laminate (1) is 9802 lb/in. 

Following the same procedure, the tensile strength of Laminate (2), [-45/0/45//90]2 S , and 
Laminate (3), [-45/0/45/0/90] 2s , are determined as 10490 lb/in and 19604 lb/in, respectively. 

4.4 Compressive strength of the laminates 

The same approach used to determine the tensile strength of the laminates was also used for 
compressive strength. The results are: 

Laminate (1), [-45/0/45/0/90] s , Compressive strength = 7435 lb/in 
Laminate (2), [-45/0/45//90] 2s , Compressive strength = 8930 lb/in 
Laminate (3), [-45/0/45/0/90] 2s , Compressive strength = 14870 lb/in 

4.5 Residual Strength of Damaged Honeycomb Sandwich Panels 

Three types of possible damage commonly found in honeycomb sandwich panels, as shown 
in Figure 4, were analyzed. For each damage type, circular and elliptical flaw areas were 
considered. In order to model the skin between two stringers, the length and the width of the 
panel are 18 inches and 24 inches, respectively. Analysis is categorized into three cases 
according to the damage configuration as follows: 
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Case 1. A honeycomb panel with variable sizes of circular or elliptical disbonds between 
face sheet and core. The maximum size of the circular disbond is 8 inches in diameter. The 
maximum size of the elliptical disbond is 12 inches in major axis. The aspect ratio of the 
ellipse is 3. 

Case 2. A honeycomb panel with variable sizes of circular or elliptical delaminations in one 
face sheet. The maximum size of the circular delamination is 8 inches in diameter. The 
maximum size of the elliptical delamination is 12 inches in major axis. The aspect ratio of 
the ellipse is 3. 

Case 3. A honeycomb panel with variable sizes of circular or elliptical notches through one 
face sheet or through the thickness of the panel. The maximum size of the circular notch is 8 
inches in diameter. The maximum size of the elliptical notch is 12 inches in major axis. The 
aspect ratio of the ellipse is 3. 

Loading conditions in the analysis include in-plane tension or compression applied at the 
edges of the face-sheets of the sandwich panel. The distribution of the load along the edge is 
assumed to be uniform. 

4.5.1 Case 1 : Panels with a Disbond. 

It is observed that the weakest portion of a honeycomb panel is the bonding between the face 
sheets and the core. The causes of the damage may be either impact from outside or 
manufacturing defects. When the panel is loaded in in-plane tension, the local disbond has 
little strength degradation since the load is carried mostly by the face-sheets. This results 
from the core having a much smaller in-plane stiffness than the face- sheet. 

However, the disbond significantly reduces the in-plane compressive strength of the 
sandwich panel because of local buckling of the face sheet in the disbond area. Therefore, 
the tensile residual strength of the sandwich panel is assumed to be the same as the total 
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tensile strength of the two face-sheets, and only sandwich panels that are loaded in in-plane 
compression are analyzed to determine their residual strength due to disbond. 

4.5.1 .1 Tensile Residual Strength of a Sandwich Panel with a Disbond. 

Based on the above discussion, the residual strengths of honeycomb sandwich panels with a 
disbond loaded in in-plane tension are independent of disbond size and core properties and 
thickness. Since the tensile strength of the laminates are already obtained and the sandwich 
panel has two face sheets, the residual strengths of the sandwiches should be: 

Residual tensile strength of the sandwich with laminate (1) = 19604 lb/in, 
Residual tensile strength of the sandwich with laminate (2) = 20980 lb/in, 
Residual tensile strength of the Sandwich with laminate (3) = 39208 lb/in. 

4.5.1 .2 Compressive Residual Strength of a Sandwich Panel with a Disbond. 

The residual strength of the disbond-damaged sandwich panel loaded in in-plane 
compression is actually its post-buckling strength. The post-buckling strength here means 
the maximum load the sandwich panel can take when post-buckling occurs in the disbond 
area. The value of the post-buckling strength depends on the size and shape of the disbond 
area, the stiffness of the face-sheet and the stiffness of the core. 

A novel two-step analysis approach has been utilized to determine post-buckling strength of 
damaged sandwich panels due to local buckling. The two steps are: i) determination of 
critical buckling load, and ii) using the critical buckling load and maximum strain criterion of 
the lamina to determine post-buckling residual strength. 

Step 1 . Determination of critical buckling load 
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Finite element model 



Due to the complexity of the geometry of the sandwich panel with a disbond, a finite element 
method must be used to obtain the solution. The general-purpose commercial finite element 
code ABAQUS is adopted as the tool for this task (Ref. 16). In this analysis, the face sheet 
laminate is modeled by shell elements with six degrees of nodal freedom and layered 
orthotropic elasticity as the material property. The honeycomb core is modeled by elastic 
springs connecting two face sheets with equivalent compressive stiffness of the core material. 
The local disbond is modeled by disconnecting the springs within the corresponding area. 

Due to the symmetry of the panel, the geometry of the disbond damage and the loading 
condition, only a quarter of the panel needs to be analyzed. The finite element mesh used in 
the analysis is shown in Figure 5 for a circular disbond and in Figure 6 for an elliptical 
disbond. Symmetric boundary conditions are prescribed along the left and lower edges of the 
finite element model. Pressure load is applied along the top edges of the face sheet of the 
finite element model. 

Determination of Equivalent Spring Stiffness 

Due to the stress concentration at the edge of the damage area, the finite element mesh is not 
uniform. When one spring is connected to each node of the face sheet, the equivalent 
stiffness of the spring depends on the local density of the mesh. In order to determine the 
equivalent stiffness of each spring, the following method is used: 

(1) Prescribe out-of-plane constraint on all the nodes of the finite element model of a face 
sheet, which is comprised of shell elements. 

(2) Apply a uniform pressure on the top surface of the face-sheet finite element model. The 
amount of the pressure is equal to the out-of-plane stiffness of the honeycomb core. 
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(3) Perform ABAQUS static stress analysis to obtain reaction forces at all the nodes. The 
reaction force at each node is the equivalent stiffness of the spring that will be connected 
to the same node. 

(4) Convert the ABAQUS output data format into its input data format for these spring 
stiffness' through a Fortran program. 

(5) Alterations of the core stiffness, as required in the parametric study, only need to multiply 
the ratio of the core stiffness to the known equivalent spring stiffness through another 
Fortran program. 

Since the disbond sizes are variable, the above procedures were used once for the finite 
element model associated with each disbond size. 

Verification of Finite Element Models for Buckling Load Determination 

In order to obtain reliable results, the finite element model was verified with available 
solutions of buckling analyses. Since closed-form solutions of the critical load of a sandwich 
panel due to local buckling are generally not available, only a face-sheet with out-of-plane 
constraint is considered in the verification. The out-of-plane constraint to the face sheet is on 
all the nodes except the nodes within the disbond area. The buckling loads of an isotropic 
rectangular plate with a circular disbond of varying sizes were computed and compared with 
Timoshenko's solution (Ref. 17) as shown in Figure 7. The case of an isotropic rectangular 
plate with an elliptical disbond of varying size is also checked with existing solutions in Yin 
and Jane (Ref. 18, 19) as shown in Figure 8. The material properties used in the verification 
computation are Young's modulus E = 10 Msi., Poisson's ratio v = 0.3, and a plate thickness 
of 0.005 inch. Reasonable agreement is reached between the present results and the well- 
known solution. 

Results of Critical Buckling Load Versus Disbond Size. 
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The critical buckling load of a face-sheet laminate with a circular disbond or an elliptical 
disbond loaded in compression was computed using the finite element model described 
above. The results of the critical buckling load versus damage size relationship are shown in 
Figure 9 and Figure 11 for the case of a circular disbond, and shown in Figure 10 and Figure 
12 for the case of an elliptical disbond. 

Parametric studies were also conducted in terms of lamina stacking sequence or laminate 
thickness. In Figure 11 and Figure 12, the varying parameter is stacking sequence. Even 
though the laminates have the same percentage of plies in each orientation, the critical 
buckling loads are different, especially in the case of elliptical disbond damage. In Figure 9 
and Figure 10, laminate thickness is varied. To provide enough data points, an intermediate 
thickness is plotted using a different stacking sequence than for the other two laminates. A 
nonlinear relationship between the critical buckling load and the laminate thickness is 
observed. When the disbond damage size is small, a small increase in laminate thickness 
results in a large increase in critical buckling load. This is consistent with the bending 
stiffness versus thickness relation. 

Step 2. Determination of Post-Buckling Residual Strength due to Local Buckling. 
Background 

In general, post-buckling residual strength of a laminate face-sheet with local damage can be 
determined through a geometrically nonlinear finite element analysis and a material failure 
criterion (Ref. 18, 19, 20, 21). This type of analysis is extensive and is presently beyond the 
thrust of this research effort. Thus, an efficient engineering approach needed to be 
developed. 

In the earlier work of Dost, et al. (Ref. 22), a simple model was proposed. This model 
assumes that the effect of the buckled area on the laminate is a soft inclusion. A reduced 
elastic modulus for the inclusion is used in determining the residual strength of the damaged 
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laminate. Obviously, this model can only be used for isotropic plates and Quasi-isotropic 
laminates, and is not suitable for the present study. 

Model for post-buckling residual strength determination 

According to linear-elastic stability theory, when buckling occurs, a constant load can still be 
carried by the buckled portion of the structure, but an uncertain level of deflection may exist. 
According to this concept, the following three assumptions are made. 

1. As an increasing load is applied to the edge of the laminate, the buckled area of the 
laminate carries a constant load, that is, the critical buckling load. This load causes a 
normal strain in the loading direction throughout the laminate, but no stress or strain 
concentration occurs even at the critical location of the edge of the buckled area. 

2. Other portion of the laminate can carry additional load. However, the total strain at the 
critical location of the edge of the buckled area is the sum of the strain caused by the 
additional load and the critical buckling load. The laminate fails when the total strain 
reaches the maximum strain limit of the zero degree ply lamina. 

3. The additional load is carried by the laminate excluding the material of the buckled 
portion. This loaded structure is modeled as the original laminate with a through notch 
located at the buckled area. The size and the shape of the notch are the same as buckled 
portion of the laminate. The critical location is the notch-tip. 

Based on these assumptions, the post-buckling residual strength, P post should be: 

Ppost= Per + Padd (4.5.1-1) 

where P cr and P a dd denote the critical buckling load and the additional load, respectively. 
The additional load is determined by maximum normal strain criterion, that is: 

{.Per Padd K)&o — £max 

(4.5.1-2) 

in which K is the notch-tip strain concentration factor, e and e max represent the uniform 
strain of the undamaged laminate in the loading direction due to unit load and maximum 
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strain the material can endure, respectively. As listed in the lamina property section, the 
maximum compressive strain of the present lamina is s max =13500 (18. e is derived in the 
laminate property determination procedures and the results are that e = 1.8158 (18 for 
Laminate (1), e = 1.5117 |ie for Laminate (2), and e = 0.9079 |ie for laminate (3), 
respectively. Since K can be determined by finite element analysis, there are only two 
unknowns, P post and P ac id in Equation (4.5.1-1) and Equation (4.5.1-2). Solving for P post 
yields: 



P = P + 

post cr 



max r> 

ci 



— (4.5.1-3) 
K 



Equation (4.5.1-3) is then used to calculate post-buckling residual strength of the sandwich 
panels with either a circular disbond or an elliptical disbond. The strain concentration factor 
K is calculated by a finite element analysis using ABAQUS. In order to obtain reliable 
results, the appropriateness of the finite element model as well as the subsequent data 
reduction method must be examined in advance. 



Verification of Finite Element Models for Notch- Tip Strength Analysis 

The same finite element models were constructed as that for the buckling analysis except that 
the elements in the disbond area are removed. In order to make comparisons with the 
classical solution, material property of isotropic elasticity is used. The stress computed by 
the finite element analysis is extrapolated to the notch-tip. The computed stress values from 
three closest to the notch-tip elements along the line of symmetry are used. A second order 
polynomial is selected to fit the data. 

Figure 13 and Figure 14 show the comparisons of the computed normal stress distribution in 
loading direction and the analytical solution (Ref. 23). Acceptable accuracy of the simple 
finite element model is obtained. The same extrapolation procedures are used in the 
evaluation of notch-tip strain to determine the strain concentration factors for both circular 
disbond and elliptical disbond situations. 



Results of Post-Buckling Residual Strength Versus Disbond Size 
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The post-buckling residual strength of the sandwich panel with a circular disbond or an 
elliptical disbond on a face- sheet laminate loaded in compression was computed using the 
method described above. The results of post-buckling residual strength versus damage size 
relationship are shown in Figure 15 and Figure 17 for the case of circular disbond, and shown 
in Figure 16 and Figure 18 for the case of elliptical disbond. 

Parametric studies were also conducted in terms of lamina stacking sequence or laminate 
thickness. In Figure 17 and Figure 18, the varying parameter is stacking sequence. There is 
no significant difference in the post-buckling residual strength as a result of variation in 
stacking sequence. In Figure 15 and Figure 16, the varying parameter is laminate thickness. 
An almost linear relationship between the critical buckling load and the laminate thickness is 
observed. When the damage size is small, the residual strength is limited by the compressive 
strength of the sandwich panel, which is the total compressive strength of the two face- 
sheets. This result means that the sandwich panel can tolerate small areas of disbond without 
reduction of compressive strength. 

4.5.2 Case 2: Panels with a Delamination 

Another commonly observed damage mechanism in sandwich panels is the delamination of 
the face-sheet laminate. Delaminations may be caused by either impact damage from outside 
or manufacturing defects. When the panel is loaded in in-plane tension, there should be, in 
general, a variable level of strength degradation since the materials on the opposite sides of 
the delamination do not have the same in-plane strain. Consequently, fracture mechanics 
analysis must be conducted and extensive computations are required. For the purposes of 
this research effort, such an analysis and computation is not intended and only a simple case 
is selected to show the feasibility of the approach and the relative data trends. 

The simple case is that the delamination occurs in the plane of symmetry of the symmetric 
laminate analyzed in the study. Since the load is primarily carried by the face-sheet, the load 
can be assumed as acting in the plane of symmetry of the laminate. In this situation, the 
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material on two sides of the delamination will still have the same in-plane strain and the load 
carrying capacity of the laminate is not affected. 

However, the delamination significantly reduces the in-plane compressive strength of the 
sandwich panel because of local buckling of the face sheet in the delaminated area. 
Therefore, the tensile residual strength of the sandwich panel is assumed to be the same as 
the total tensile strength of the two face- sheets, and only sandwich panels that are loaded in 
in-plane compression were analyzed to determine their residual strength due to delamination. 

4.5.2.1 Tensile Residual Strength of a Sandwich Panel with a Delamination 

Based on the above discussion, the residual strengths of honeycomb sandwich panels with 
delaminations loaded in in-plane tension are independent of delamination size and core 
properties and thickness. Since the tensile strength of the laminates are already obtained and 
the sandwich panel has two face sheets, the residual strengths of the sandwich should be: 

Residual tensile strength of the sandwich with laminate (1) = 19604 lb/in, 
Residual tensile strength of the sandwich with laminate (2) = 20980 lb/in, 
Residual tensile strength of the Sandwich with laminate (3) = 39208 lb/in. 

4.5.2.2 Compressive Residual Strength of a Sandwich Panel with a Delamination 

The residual strength of the delamination damaged sandwich panel loaded in in-plane 
compression is actually its post-buckling strength. The post-buckling strength here means 
the maximum load the sandwich panel can take when post-buckling of the sub-laminate 
occurs in the delamination area. The value of the post-buckling strength depends on the size 
and shape of the delamination area, the stiffness of the sub-laminate of the face-sheet and the 
stiffness of the core. 
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The two-step analysis approach to the residual strength of sandwich panels due to disbond 
was also used to determine post-buckling residual strength of damaged sandwich panels due 
to delamination. 

Step 1. Determination of Critical Buckling Load 
Finite element model 

In order to model the delamination, the locally delaminated face sheet is represented by two 
bonded layers of shell elements. The same type of element was used as for the panel with a 
disbond. The two layers of the shell elements are connected by rigid beam elements at each 
in-plane nodal point. The honeycomb core is modeled by elastic springs connecting the two 
face sheets with equivalent compressive stiffness of the core material. The local 
delamination is modeled by disconnecting the two layers of shell elements within the 
corresponding area. 

Only a quarter of the sandwich panel needs to be analyzed, owing to the symmetry of the 
panel, the geometry of the delamination damage and the loading condition. The same in- 
plane finite element meshes as in the analysis of a panel with a disbond were used, which are 
shown in Figure 5 for a circular delamination and in Figure 6 for an elliptical delamination, 
respectively. Symmetric boundary conditions are also prescribed along the left and lower 
edges of the finite element model, and pressure load is also applied along the top edges of the 
face sheet of the finite element model as in the disbond model. 

Determination of Equivalent Spring Stiffness 

The same procedures used for Case 1 were used for this case. The only difference is that in 
this case the stiffness of the springs are independent of damage size. The reason is that one 
layer of the face-sheet laminate is always bonded to the core. Every node of this layer of the 
finite element model is connected to a spring regardless of the size of the delamination. 



Verification of Finite Element Models for Buckling Load Determination 
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The verification of the finite element analysis for critical buckling load determination 
provided in the section of disbond damage is still meaningful for the case of delamination 
damage. Hence, it is not repeated here. 

Results of Critical Buckling Load Versus Delamination Size 

The critical buckling load of a face- sheet laminate with a circular delamination or an 
elliptical delamination loaded in compression was computed using the finite element model 
described above. The results of the critical buckling load versus damage size relationship are 
shown in Figure 19 and Figure 21 for the case of circular delamination, and shown in Figure 
20 and Figure 22 for the case of elliptical delamination. 

Parametric studies were also conducted in terms of lamina stacking sequence or laminate 
thickness. In Figure 21 and Figure 22, the varying parameter is stacking sequence. Even 
though the laminates have the same percentage of plies in each orientation, the critical 
buckling loads are different. In Figure 19 and Figure 20, the varying parameter is laminate 
thickness. To provide enough data points, an intermediate thickness is plotted using a 
different stacking sequence than for the other two laminates. A nonlinear relationship 
between the critical buckling load and the laminate thickness is observed. When the damage 
size is small, a small increase in laminate thickness results in a large increase in critical 
buckling load. This is consistent with the bending stiffness versus thickness relation. 

Step 2. Determination of Post-Buckling Residual Strength due to Local Buckling 

Background 

The method for determination of post-buckling residual strength due to local buckling, as 
described in the section of disbond damage, is still valid for the case of delamination. The 
exception is that the assumed notch in the model described in the last section is only on the 
buckled layer of the sub-laminate of the face- sheet laminate instead of being through- the- 
thickness. The same extrapolation procedures as those used for the case of disbond damages 
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are used in the evaluation of notch-tip strain to determine the strain concentration factors for 
the case of delamination damages. 

Results of Post-Buckling Residual Strength Versus Delamination Size 

The post-buckling residual strength of the sandwich panel with a circular delamination or an 
elliptical delamination on a face-sheet laminate loaded in compression was computed using 
the method described above. The results of post-buckling residual strength versus damage 
size relationship are shown in Figure 23 and Figure 25 for the case of a circular delamination, 
and shown in Figure 24 and Figure 26 for the case of an elliptical delamination. 

Parametric studies were also conducted in terms of lamina stacking sequence or laminate 
thickness. In Figure 25 and Figure 26, the varying parameter is stacking sequence. There is 
no significant difference in the post-buckling residual strength as a result of the variation in 
stacking sequence. In Figure 23 and Figure 24, the varying parameter is laminate thickness. 
An almost linear relationship between the critical buckling load and the laminate thickness is 
observed. When the damage size is small, the residual strength is limited by the compressive 
strength of the sandwich panel, which is the total compressive strength of the two face- 
sheets. This result means that the sandwich panel can tolerate small areas of delamination. 

4.5.3 Case 3: Panels with Notches 

Severe impact damage occurring in a face sheet laminate is often treated as an open hole for 
convenience. The open hole can then be modeled as a through-the-thickness notch in the 
damaged area. Notch data can also be used to model cracks, and so notch analyses results for 
this study were assumed to be applicable to both open hole and through-thickness crack 
behavior of the sandwich. The notched strength of the laminate cannot be directly calculated 
from the stress concentration factor and the unnotched strength of the laminate. In fact, the 
strength of the laminate material in the stress concentration area is usually higher than the 
global strength of the laminate. Extensive research has been conducted in past two decades 
and many theories have been developed to describe this phenomenon (Ref. 23, 24, 25, 26, 27, 
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28). However, due to the complicated nature of the composite structure subject to damage, 
up to now there is still no means to determine notched strength without testing a notched 
laminate specimen. 



The residual strength of a sandwich panel with a notch on its one or two face-sheet laminates 
or through its thickness is primarily determined by the residual strength of the constitutive 
laminates. Therefore, test data on the residual strength of a laminate were used. The data are 
characterized by the well-accepted Mar-Lin model (Ref. 25). However, the Mar-Lin 
parameters are for laminates that are infinitely large and have different lamina tensile and 
compressive strengths from the material used here. In order to use the test data to determine 
residual strength of the sandwich panels, three-dimensional finite element analyses were 
performed to make the correction. 

Mar-Lin Model Parameters 

The fracture model proposed by Mar and Lin is expressed in the following form: 

g" = , H < (4.5.3-1) 
N (2cfY 

in which: 

8n°° = remote strain 

m = order of singularity 

H c = composite fracture toughness 

c = half crack length 

Y = geometry factor 

The basic material properties and the Mar-Lin model parameters used in this study are: 
In tension: 

Ply strength in fiber direction, X = 250 ksi, 
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Laminate (1) [-45/0/45/0/90] s H c = 0.00667 in m , m = 0.225, 
Laminate (2) [-45/0/45/90] 2s H c = 0.00667 in m , m = 0.203, 
Laminate (3) [-45/0/45/0/90] 2s H c = 0.00667 in m , m = 0.225, 

In compression: 

Ply strength in fiber direction, X' = 220 ksi, 
Laminate (1) [-45/0/45/0/90] s H c = 0.0034 in m , m = 0.35, 
Laminate (2) [-45/0/45/90] 2s H c = 0.0043 in m , m = 0.26, 
Laminate (3) [-45/0/45/0/90] 2s H c = 0.0034 in m , m = 0.35, 

The remote load intensity is then calculated by: 

P;=e;E N T L (4.5.3-2) 

in which En is the in-plane elastic modulus of the laminate in loading direction and Tl is the 
thickness of the laminate. For the laminate used here, these parameters are: 

In tension: 

Laminate (1) [-45/0/45/0/90] s E N = 1 1 .653 mpsi, T L = 0.05 inch, 
Laminate (2) [-45/0/45/90] 2s E N = 8.841 mpsi, T L = 0.08 inch, 
Laminate (3) [-45/0/45/0/90] 2s E N =1 1 .653 mpsi, T L = 0. 10 inch, 
In compression: 

Laminate (1) [-45/0/45/0/90] s E N = 1 1 .233 mpsi, T L = 0.05 inch, 
Laminate (2) [-45/0/45/90] 2s E N = 8.541 mpsi, T L = 0.08 inch, 
Laminate (3) [-45/0/45/0/90] 2s E N =\\ .233 mpsi, T L = 0. 10 inch, 

The elastic modulus values are calculated from lamina properties given in 
Section 4.2 using lamination theory. 
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Finite Element Model 



Two finite element models were constructed for the analysis of the sandwich panels with 
notches. One of them is for the case that a notch is in one face- sheet and the other is for the 
case of a through-the-thickness notch. The finite element model of the two face sheets is the 
same as that used in the analysis of a panel with a disbond. The honeycomb core is modeled 
by eight-node solid elements with linear elastic properties. The connection between each 
face sheet and the core is built with rigid beam elements positioned at every in-plane nodal 
point of the 3-D finite element model of the sandwich panel. 

In the case of only one face- sheet having a notch, the geometry of the notched panel and its 
associated loading condition allow only a quarter of the panel to be analyzed. Due to the 
same reason and the symmetry about the mid-plane of the sandwich panel, only one eighth of 
the panel needs to be analyzed for the case of both the face- sheet and the core having a 
through-the-thickness notch. The in-plane finite element meshes used in this analysis are 
also the same as those in the previous cases. The boundary conditions and the loading 
conditions are also prescribed in the same manner as in the previous cases. 

Geometry Factors 

The geometry factors for the case of one face-sheet having a notch and the case of the 
sandwich panel having a through-the-thickness notch of variable size were obtained by finite 
element analysis. The baseline case is that the laminate size is 90 in x 90 in, which is at least 
60 times the notch size. 

Results of Residual Strength Versus Notch Size 

Assuming that the Mar-Lin model parameter H c is proportional to the corresponding lamina 
strength in both tension and compression, the residual strength of the sandwich panel with a 
face-sheet laminate having a circular notch or an elliptical notch loaded in tension or in 
compression was calculated according to the formula: 
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(4.5.3-3) 



in which S denotes the current ply strength in the fiber direction and S the ply strength in the 
fiber direction of the test specimen used in the test. Equation (4.5.3-3) is derived using 
Equation (4.5.3-1), Equation (4.5.3-2), the assumption on H c and consideration of two 
laminates carrying load. 

The results of the tensile residual strength versus damage size relationship are shown in 
Figure 27 and Figure 29 for the case of a circular notch, and shown in Figure 28 and Figure 
30 for the case of an elliptical notch, respectively. The results of the compressive residual 
strength versus damage size relationship are shown in Figure 31 and Figure 33 for the case of 
a circular notch, and shown in Figure 32 and Figure 34 for the case of an elliptical notch, 
respectively. Parametric studies were also conducted in terms of laminate thickness and the 
results are given in the figures. 

4.6 Discussion 

It was found that the core stiffness cannot be an independent variable. The thicker the 
laminate, the stiffer the core must be to avoid global buckling of the face sheet. Another 
factor for selecting core stiffness is the weight of the sandwich panel. For the same core 
material, the stiffer core will generally be heavier. Therefore, the best core density or 
stiffness must be determined for each face-sheet laminate. 

4.7 Summary 

• Methods for residual strength analyses of sandwich panels with a disbond, delamination 
or notch have been developed. 

• Appropriate finite element models for the residual strength analyses of the three cases 
(disbond, delamination and notch) have been constructed. 
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Results on critical buckling loads and post-buckling strength for sandwich panels with 
disbond or delamination have been obtained. 

Results on residual strength for sandwich panels with a single notch on one face sheet or 
a through the thickness notch have been obtained. 

Parametric studies have been conducted to determine the critical buckling load of face 
sheets and post-buckling residual strength of sandwich panels with a disbond, 
delamination or a notch. 

Both tension and compression loading conditions are included in the damage tolerance 
analysis for all the cases studied. 
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5 DEMONSTRATION OF DESIGN METHOD 



5.1 Introduction 

The general method and equations for the equivalent "Level of Safety" design approach have 
been defined in Section 3.2. To demonstrate the process as applied to an advanced structural 
concept, a composite honeycomb material system was chosen for analysis. The damage 
tolerance behavior of the composite has been investigated using the deterministic analysis 
methods outlined in Section 4. Design charts of the residual strength of a sandwich panel 
versus flaw size for various types of damage are shown in the figures of the Appendix. 
Using this data, the "Level of Safety" methodology is applied to the sandwich panel to 
determine the size of panel necessary to meet the design safety criteria for a given load level. 
The details of this example are described in the following section. 

5.2 Outline of Design Procedures 

Detailed derivations and assumptions inherent in the "Level of Safety" method have been 
defined previously in Section 3.2. The overall method of application is restated and 
condensed into a step-by-step process here to illustrate how the design procedure progresses 
using the given examples. 

"Level of Safety" Evaluation on Existing Structure 

The "Level of Safety" of an existing structure can be determined through the following steps: 

1 . Collect damage data on the distributions of flaw sizes, flaw types, number of flaws and 
detection methods for an existing structure, as described in Section 3.4. 

2. Estimate the probability of detection curves for each type of damage detected on the 
existing structure, using the assumptions described in Section 3.3. 
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3. Using the data from Steps 1 and 2, coupled with design data on the residual strength of 
the structure as a function of damage size, determine the "Level of Safety" of the existing 
structure using the formulas derived in Section 3.2. This result becomes the allowable 
value of "Level of Safety" for new designs. 

"Level of Safety" Approach for Design 

Use of the equivalent "Level of Safety" approach for the design of new structures can be 
accomplished through the following steps: 

4. Perform analysis to determine the residual strength of the new structure as a function of 
damage size and the various structural sizing parameters of interest. 

5. Assume distributions of detected damage size po(o) and probability of detection curves 
Pd(o) based on available data and engineering judgement. 

6. Using the "Level of Safety" formulas derived in Section 3.2, combined with the data 
from Steps 4 and 5, determine the relation between structural geometry and "Level of 
Safety" for given load levels. 

7. Using the allowable value of "Level of Safety" from Step 3, size the structure to give a 
"Level of Safety" equal to or greater than the allowable. 

8. After the structure has been built and put into service, collect data on the damage 
accumulated during operation. 

9. Bayesian statistical methods defined in Section 3.6, combined with the data from Step 8, 
can be used to update the assumed probability distributions of Step 5, and to recalculate 
the "Level of Safety" of the structure. 
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10. If the "Level of Safety" falls below the allowable value, the inspection and maintenance 
program can be updated to provide earlier or more frequent detection opportunities to 
return the "Level of Safety" to its design value. 



5.3 Examples of Equivalent Safety Based Design 

Some illustrative examples are used here to demonstrate the application of the equivalent 
safety design approach. The task is to design a composite sandwich compression panel that 
will at a minimum maintain the same Level of Safety as an existing aluminum one. The 
allowable Level of Safety, taken from the metal structure, is 99.9%. This translates into a 
Probability of Failure of 0.1%. 

For the sake of simplicity, consider a case of only one damage type (disbonding), one 
damage location and one flaw in the sandwich structure. Two different types of inspection 
methods are to be used to detect the damage. The probability of detection of disbond damage 

for the two inspection types are assumed to be P D (a) = 1 - e~ a 112 for Inspection Type I and 

P D (a) = \-e for Inspection Type II. The detection probabilities as a function of 

damage size are plotted in Figure 35. Each inspection type has a different detected damage 
size distribution po(o) associated with it. The detected damage is assumed to follow a 
Gamma distribution with the parameters k = 2.1, 6 = 1.3 for Inspection Type I, and 
parameters k = 2.2, 8= 1.5 for Inspection Type II: 



Detected damage probabilities are plotted in Figure 36. The damage size variable a is taken 
to be the disbond diameter in inches for each function. 

Using equation (3.2-10) from Section 3.2, along with the probability distributions assumed 
above, the normalizing constant for the "Level of Safety" calculation is integrated 
numerically using the SLATEC DQAGI Gaussian quadrature subroutine in double-precision 
FORTRAN. For each iteration, relative and absolute error for convergence of the subroutine 



P „(<*) = 



k T(k) 



1 




(5.3-1) 
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was set at 10 . To illustrate the convergence properties of the assumed distributions, the 
integral solutions are listed in Table 1 as the lower limit of integration s approaches zero. 



Table 1. Convergence Table of Normalizing Constant 1/C 
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10 4 


1.80730322 


2.22955533 


10 5 


1.80859168 


2.23020679 


10 6 


1.80884877 


2.23031005 


10 7 


1.80890007 


2.23032641 


10 8 


1.80891030 


2.23032900 



Roundoff error was detected by the integration subroutine at e values of 10 9 , so the most 
reliable estimates for the normalizing constants are listed at 10 8 . Based on the behavior 
shown, the integral is assumed to converge to a finite value for both inspection types, and the 
distribution of p(a) is assumed to be a valid probability function. 

Using Equation (3.2-13) and the normalizing constants calculated previously, the "Level of 
Safety" of the sandwich panel is calculated as a function of disbond size and inspection type. 
The equations are integrated numerically using a trapezoidal scheme in an Excel spreadsheet, 
with the results plotted in Figure 37. Elimination of disbond size from the Level of Safety 
plots can be performed by substituting the residual strength versus critical damage size 
relations obtained in Section 4. Relations between design load and "Level of Safety", as a 
function of the sizing parameters of laminate thickness and stacking sequence, are then 
established and shown in Figures 38 through 41. Data points with a "Level of Safety" lower 
than 80% are not shown in the figures, as these are generally outside the design range of 
interest. Alternatively, plots of design load versus "Probability of Failure" relationships can 
also be obtained, and are shown in Figures 42 through 45. It is more practical to use these 
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curves rather than the "Level of Safety" plots since "Level of Safety" is so close to unity for 
the typical design range of interest. 

For a given limit load Pu„, of 8000 lbs./in., the minimum laminate thickness and stacking 
sequence necessary to provide a "Level of Safety" above the metal structure is found from 
the charts of Figures 42 through 45. At an allowable "Probability of Failure" PF a u 0W of 
0.1%, the results are: 

Inspection Type I 

Circular Disbond - min. laminate (-45/0/45/90)2 S 
Elliptical Disbond - min. laminate (-45/0/45/90) 2s 

Inspection Type II 

Circular Disbond - min. laminate (-45/0/45/0/90) 2s 
Elliptical Disbond - min. laminate (-45/0/45/90) 2s 

From these results, it can be seen that the parameters of the inspection type have a strong 
influence on the resulting size of the structure. Inspection Type 2 has a somewhat lower 
detection probability than Inspection Type 1, as is shown in Figure 35. This means that if 
only Inspection Type 2 were used in the inspection and maintenance program for the 
structure, the largest laminate thickness of (-45/0/45/0/90)2 S must be used to maintain the 
"Level of Safety" above that of the existing metal structure. If only Inspection Type 1 is 
used, or some combination of Types 1 and 2, a smaller laminate thickness (-45/0/45/90) 2s 
may be utilized, thus realizing substantial weight and cost savings for the design. 

This type of design trade is also subject to the costs and operational considerations of the 
different inspection types. In general, as detection probabilities increase for a specific 
detection method, the cost and difficulties in applying the method to the inspection of actual 
aircraft components also increase. Therefore, from a life-cycle standpoint, it may be better to 
accept the lower detection probability associated with Inspection Type 2 and use a larger 
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laminate thickness in the final design. The "Level of Safety" methodology, and the data that 
results from it, allows the designer to make these types of cost-benefit trades on a 
quantitative basis early in the design process. 

Once the structure is in service, the data collected on the damage sizes detected during 
operational inspections is used with the Bayesian statistical method to update the assumed 
damage size distributions. Since an example of this process is described in Section 3.6, it 
will not be repeated here. The revised damage size distribution can be used to recalculate the 
"Level of Safety" of the structure, thus validating the assumptions made in the design 
process. 

A more detailed example is also shown to illustrate the equivalent safety method using 
multiple damage types in different locations. The composite sandwich panel discussed 
previously will be redesigned for a load concentration at a particular location. The far-field 
loading area on the panel is referred to as Location 1, and the load concentration area is 
referred to as Location 2. Location 1 uses a laminate stacking sequence of (-45/0/45/90) 2s , 
and Location 2 uses a (-45/0/45/0/90) 2s stacking sequence. Location 1 is subject to two 
flaws: a circular disbond and an elliptical delamination. Location 2 is subject to an elliptical 
disbond and a circular delamination. Each flaw type at each location has a unique detected 
damage size distribution po(o) and detection probability Pd(o) associated with it. The 
nomenclature of each curve is listed below, where ju is an array of the mean number of flaws 
at each damage location: 



Location 1 



Circular Disbond (a = diameter) 



Poii(a), PDii(a), jun = 1 



Elliptical Delamination (a = major axis) 



Po2i(a), Pd2i(o), jl 2 i = 1 



Location 2 



Elliptical Disbond (a = major axis) 



Ponfa), P D n(a), JU12 = 1 
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Circular Delamination (a = diameter) 



p 022(a), P D 22(a), JU22 = 1 



For simplicity, it is assumed that all of the detected damage size distributions follow the 
curves of Equation (5.3-1). Inspection Type II is to be used at Location 1, and Inspection 
Type I is to be used at Location 2. The detection probabilities for each inspection type are 
the same as those in the previous example: 

p 012(a) = p 022(a) = p i(a) 

Poii(a) = p 021(a) =p ii(a) 
P D i2(a) = P D2 2(a) = P D i(a) 
PDii(a) = P D 2i(a) = P D n(a) 

A design limit load of Pu m -i = 6000 lbs. /in. is applied to Location 1, and a limit load of Pu m -2 
= 17,500 lbs./in. is applied to Location 2. The allowable "Level of Safety" for the entire 
structure is 99.9%. For the circular disbond damage at Location 1, Figure 44 can be used to 
determine the "Probability of Failure" for the sandwich at a 6000 lb./in. load. The result is 
PF n = 1x10 4 , which translates into a "Level of Safety" of LS n = 0.9999. For the elliptical 
delamination damage at Location 1, Figure 53 is used to find a "Probability of Failure" of 
PF21 = 0.0. This is because the damage tolerance analysis shows that a panel with a circular 
delamination will not fail at the given limit load for any of the damage sizes investigated. 
For the elliptical disbond at Location 2, Figure 43 is used to find a "Probability of Failure" of 
PF12 = 6x10 5 . For the circular delamination at Location 2, Figure 50 is used to find a 
"Probability of Failure" of PF ]2 = 5x10 7 . These results are listed in tabular form as: 

Location 1 

Circular Disbond PF n = 1x10 4 , LS n = 0.9999 

Elliptical Delamination PF 2 i = 0.0, LS21 = 1.0 

Location 2 

Elliptical Disbond PF 12 = 6x10 5 , LS 12 = 0.99994 
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Circular Delamination 



PF 22 = 5x10 7 , LS22 = 0.9999995 



Using Equation (3.2-19), the overall "Level of Safety" of the structure can be determined as: 

LS = LS U - LS 1T LS 2r LS 22 = (0.9999) (1.0)(0.99994)(0.9999995) = 99.98% 

For the allowable "Level of Safety" of LS a „ 0W = 99.9%, the calculated "Level of Safety" 
value exceeds the allowable by 0.02%. Thus, for the damage profile analyzed, the new 
design has a higher safety than the existing structure it will replace. 

The "Level of Safety" method provides an estimate of the actual damage size distribution in 
a structure. These estimates will vary depending on the inspection method utilized and the 
accuracy of the probability distributions in the formula. The actual damage size distribution 
based on the detected damage sizes and detection probabilities can be calculated by the 
equation: 



The results of this calculation using the distributions assumed in the example problems are 
plotted in Figure 54 for the two inspection types. The curves are very close to each other, 
indicating that the distributions assumed in the example problem closely approximate the 
actual damage distributions for both inspection types. Results using actual data may vary 
significantly, however, for various inspection types. Figure 54 also illustrates the behavior of 
the distribution of p(a) as discussed in Section 3.8, in that it asymptotically approaches 
infinity as the damage size a goes to zero. 




(5.3-2) 
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6 RESULTS AND CONCLUSIONS 



6.1 Benefits of an Equivalent Level of Safety Approach 

The benefits of an equivalent "Level of Safety" approach to aircraft design are many and 
varied. By taking a probabilistic approach to structural failure, the need for arbitrary factors 
of safety based on traditional design practices is substantially reduced. This frees the 
designer to pursue maximum structural efficiencies in the design, while still maintaining 
safety equivalent to, or better than existing structures. The "Level of Safety" methodology is 
a data-driven process that also allows for the inclusion of empirical, or "soft" data, along 
with engineering judgement, to quantify the uncertainty associated with the damage tolerance 
characteristics of a structure. It incorporates planning for the service inspection program into 
the design process. The method is applicable to any type of structure or material system 
where damage mechanisms have been characterized, and allows an objective comparison of 
relative safety to be made between dissimilar structures, or similar structures in different 
operating environments. The incorporation of Bayesian statistical tools into the "Level of 
Safety" method provides a mechanism for validating the damage assumptions made during 
the design process, and for reducing the level of uncertainty and risk over the life-cycle of the 
structure. Also important, the method provides a valuable tool for airlines and flight 
certification authorities to manage risk in a fleet of aircraft, and over a range of aircraft types. 

6.2 Limitations of the Current Formulation 

As presented here, the equivalent safety methodology does not currently encompass the 
range of damage tolerance issues needed to fully characterize the operational "Level of 
Safety" of a particular structure. The existing derivation only describes a structure's "Level 
of Safety" for a single inspection event at a fixed point in time, and is essentially a state 
variable. However, the state of damage in the structure is continually changing with time, 
meaning that the "Level of Safety" value just calculated is invalid at any other point in time 
other than the instant of calculation. Past experience with mechanical systems holds that 
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structures in an operational environment accumulate damage over a period of time, and 
previously accumulated damage may grow due to cyclical loading. However, the current 
formulation does not account for this. As damage is accumulated, the "Level of Safety" of 
the structure will decrease over time, until the damage is detected and repaired at the next 
scheduled inspection event. Undetected damage will continue to grow until reaching a size 
that can be detected at some future time. Therefore, it is also necessary to incorporate the 
scheduling of multiple inspection and repair events into the method to periodically return the 
"Level of Safety" to a point above its critical design value. 

Interactions between different damage types, and multiple damage events are also neglected 
in the current formulation. The location of the damage plays a strong role in these effects, 
and can be modeled partially by assuming the worst-case location for damage accumulation 
in the analysis of the residual strength vs. damage size for the structure. However, this may 
lead to overly-conservative residual strength results. To alleviate this, detailed data must be 
collected on the locations of damage relative to the zones of stress concentration, which 
could prove difficult to obtain. 

The behavior of the detection probability and detected damage size distributions needs to be 
investigated using experimental data for a range of structural configurations. It is unknown 
how difficult it will be for probability distributions based on actual data to meet the 
conditions discussed in Section 3.8. The criteria that the probability density function 
estimate of actual damage must be integrable over the entire domain of damage sizes my 
prove to be so difficult to satisfy for the current "Level of Safety" formulation that the 
method may need to be reformulated to be of any practical use. 

Another unquantified variable in the method is the effect that finite data sets have on the 
confidence level of the equivalent safety estimates. Generally, the more data points that are 
used, the higher the confidence level will be. With a finite number of data and a required 
confidence level, the valid "Level of Safety" can only be the lower limit of the one-side 
confidence interval of the quantity. This may unnecessarily penalize the structure in the 
design phase, when detailed damage data is most difficult to come by. 
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6.3 Topics for Further Research 



The following topics are recommended for further research to investigate the sensitivity of 
the method to some of the issues mentioned previously, and to extend the method to cover a 
broader range of damage tolerance issues: 



• Behavior of probability distributions derived from actual damage data for a variety of 
structures. 

• Extension of present method to incorporate rates of damage accumulation, and multiple 
inspection intervals. 

• Demonstration of method on built-up and monolithic structures, including wings, 
fuselages, empennage, etc. 

• Investigation of finite data set effects and confidence level determination. 

• Incorporation of damage interaction and growth effects. 

• Extension of method to incorporate probabilistic assessments of other variables such as 
loading, material properties, manufacturing variation, etc. 

• Characterization of probability of detection curves for service inspection methods of 
composite structures. 
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7 APPENDIX 
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Start of design process 



Probability density Probability of total Probability of flaw 

of detected flaw size number of flaws for detection as a function of 

for each flaw type in each flaw type in flaw size for each flaw 

each location each location type in each location 



Determination of 
residual strength 
of damaged 
structures using 
FEM 



Bayesian 
updating of 
damage 
data 



Damage data 
collected from 
in-service 
inspection 



Evaluation of Level of 
Safety of the structure 
using the definition of 
Level of Safety and 
critical damage size 



In design process 



Selecting structure size for 
the local load to satisfy the 
required Level of Safety 
via critical damage size 



Accepted Level 
of Safety taken 
from existing 
airplanes 



During operation 



Update 

inspection and 
maintenance plan 



Manufacture and operation 



Figure 1. Flow-Chart of Developing Equivalent Safety Aircraft 
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